Management prepares a remediation plan to formally manage the resolution of findings identified in risk assessment activities.
Risk assessments find and prioritize risks, but that information and insight is only useful if it's acted on. This control aims to ensure the risks we find in risk assessments are appropriately acted on and remediation efforts are seen to their full completion.
This control applies to all risk assessments and their respective risk findings.
Control Owner: Security Compliance
Process owner(s):
System Owners
Data Protection Officers
Security Compliance
Non-public information relating to this security control as well as links to the work associated with various phases of project work can be found in the Remediation Tracking control issue.
Examples of evidence an auditor might request to satisfy this control:
Copy of the risk tracking and remediation process.
Copy of the risk registry.
Sample risk remediation issues.
SOC2 CC
CC4.2
CC5.1
CC5.2